Resilient Quantum Computation: Error Models and Thresholds 
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Recent research has demonstrated that quantum comput- 
ers can solve certain types of problems substantially faster 
than the known classical algorithms. These problems include 
factoring integers and certain physics simulations. Practical 
quantum computation requires overcoming the problems of 
environmental noise and operational errors, problems which 
appear to be much more severe than in classical computation 
due to the inherent fragility of quantum superpositions involv- 
ing many degrees of freedom. Here we show that arbitrarily 
accurate quantum computations are possible provided that 
the error per operation is below a threshold value. The result 
is obtained by combining quantum error-correction, fault tol- 
erant state recovery, fault tolerant encoding of operations and 
concatenation. It holds under physically realistic assumptions 
on the errors. 

The discovery that quantum computers can be much 
more powerful than their classical counterparts |l|-|4l and 
recent advances in quantum device technology |3|,|6| have 
brought the field of quantum computation into the lime- 
light. However, until recently, the hope of taming quan- 
tum systems has been overshadowed by the fragility of 
quantum information. Not only must it be preserved 
in memory, but it should not be lost when manipulated. 
This fragility comes from two seemingly contradictory re- 
quirements. The system must be well insulated from the 
environment to avoid losses, while at the same time we 
need to interact with it strongly to perform the desired 
computation. Due to these requirements, it is impossible 
to completely isolate a physical quantum computer from 
the environment. As a result, the computer necessarily 
becomes increasingly entangled with the outside world 
and any quantum information it contains is apparently 
lost. Moreover, quantum computation requires the ap- 
plication of precise unitary operations to the system. It 
is clear that these operations cannot be implemented ex- 
actly. For these reasons, some authors have concluded 
that the theoretical power of quantum computers cannot 
be harnessed J7|,||. 

The first indication that early assessments of the prac- 
ticality of quantum computation might be overly pes- 
simistic was the discovery of quantum error-correcting 
codes by Shor M and Steane ]lO| . These codes imply 
that it is possible to overcome memory or transmission 
errors provided that the unitary operators required for 
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encoding, decoding and error-correction could be imple- 
mented with high accuracy. Subsequent work on quan- 
tum error-correction has yielded very efficient codes and 
generalized much of the classical theory |ll|-|lq|. The 
requirement of accurate error-correction operations was 
soon relaxed by Shor flq| and essentially eliminated in 
the case of quantum channels in |JL7[ . To use quantum 
error-correction for quantum computation requires not 
only encoding states, but manipulating them in encoded 
form. That this can be done in some interesting cases 
was discovered independently by Shor Eq], Kitaev |l§| ] 
and two of us (W.Z. & R.L. Ea]). Shor's results in par- 
ticular showed that provided the noisy behavior of quan- 
tum memory and gates is stochastic with error proba- 
bility of the order of 0(log~ Qn ) (where n is the total 
number of noisy operations in the quantum network and 
a is a positive constant), arbitrarily accurate encoded 
quantum computation is possible. This was a substan- 
tial improvement over the best previous bound of 0(1 /n) 
and removed almost all fundamental obstacles to practi- 
cal quantum computation. 

Two obstacles to quantum computation remained. 
The first is that as the number of elementary quan- 
tum operations grow, Shor's fault tolerant implementa- 
tion still require asymptotically zero error per operation. 
The second concerns the fact that many if not most error 
types expected in real devices cannot be represented in 
the stochastic error model. In particular, unitary over- 
rotation of operations and small but non-negligible in- 
teractions between nearby qubits give rise to such er- 
rors. The purpose of this paper is to show that an error 
threshold exists such that if each gate in a physical im- 
plementation of a quantum network has error less than 
this threshold, it is possible to perform encoded quantum 
computations with arbitrary accuracy. This result holds 
under physically realistic error models, thus showing that 
in principle, unlimited quantum computation with noise 
is possible. 

In the first part of the paper we introduce the different 
techniques required to implement quantum fault toler- 
ance. We emphasize the various assumptions on errors 
and then introduce four fundamental elements of fault 
tolerance: quantum error-correcting codes, fault tolerant 
error-correction methods, encoded operations and con- 
catenation. We introduce a new method for obtaining 
a complete set of fault tolerantly encodable operations 
which greatly simplifies the analysis. We combine the el- 
ements to implement a computation fault tolerantly. In 
the second part, the fault tolerant networks are analyzed 
to obtain rigorous thresholds for the quasi-independent 



stochastic and monotonic error models. 



I. METHODS 



details of the implementation, but also on the assump- 
tions on error behavior. The values determined below 
could be substantially improved in a particular physcial 
setting. 



A. Quantum networks and operations 

We can assume without loss of generality that quan- 
tum algorithms are described by means of a quantum 
networkR. A quantum network is a space-time diagram 
of the operations that are to be applied to each qubit. 
Recall that a qubit is the prototypical two state system. 
It's state space is the Hilbert space spanned by |0) and 
|1). A qubit 's time line is represented by a horizontal 
line, and operations, that is quantum gates, are denoted 
by blocks or vertical lines connected to the qubits being 
acted on. (See the figures for examples). A complete set 
of unitary operations can be formed from controlled-nots 
and one qubit phase shifts S] . A useful set of operations 
consists of the sign and the bit flip, the controlled- not, 
the Hadamard transform and the phase shift of |1) by 
i. These generate the normalizer group. To these one 
can add the Toffoli gate to achieve completeness p6[ . 
The operations' actions and symbols are defined in Ta- 
ble 0. To be able to perform quantum computations re- 
quires at least two more operations: preparation of |0) 
and measurement of |0), |1) which we call the classical 
basis. We choose to complete the set of operations by 
adding preparation of |7r/8) = cos(7r/8)|0) + sin(7r/8)|l) 
to our repertoire rather than the Toffoli gate. A circuit 
which implements the Toffoli gate using this operation is 
given in Figure U Finally, in many cases, classical com- 
putation can be used to process measurement outcomes 
and control future quantum gates. Classical (reversible, 
if so desired) circuits may be used to represent these com- 
putations. 

The primary purpose of a quantum algorithm is to pro- 
duce a desired quantum state from classical input such 
as |0). Normally, some or all of the output state's qubits 
are measured to obtain the actual information that is 
needed. Our main goal is to describe an implementa- 
tion of quantum algorithms which satisfies that if each 
gate's error is below a threshold value, the algorithm's 
computational state is maintained with arbitrary accu- 
racy in an encoded form. Furthermore, the bits of the 
computational state can be measured and the outcome 
is consistent with the claimed accuracy of the state. 

It is important to realize that the existence and actual 
value of the threshold depend critically not only on the 
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B. Assumptions and error models 

To describe a noisy quantum network we introduce the 
notion of error locations. Error locations are to be chosen 
such that one can assume without loss of generality that 
errors "occur" only at those locations, and that these 
errors satisfy some independence properties with quan- 
tifiable error probabilities or strengths. 

We consider two types of error locations: operational 
error locations and memory error locations. The former 
exists after each gate (including state preparation but not 
measurements) and extends over all the qubits involved 
in the gate's operation. The latter exists on each line seg- 
ment representing a unit time interval of a qubit 's time 
line, provided the qubit is not involved in a gate in this 
interval. The placement of memory errors depends on 
the temporal layout of a network and requires partition- 
ing the network into unit time slices. The time units are 
determined by the maximum execution time of a gate. 
Figure ffl shows how error locations are placed in one of 
the component networks required for fault tolerant com- 
puting. 

We are assuming that sufficiently many gates can be 
executed in parallel to avoid loss of quantum information 
in memory. In fact, there is a trade-off between memory 
error and parallelism. If t is the maximum time a qubit 's 
state can be left in storage without unacceptable loss 
of information, then the minimum number of operations 
per unit time must be well above q/t, where q is the 
number of qubits actively involved in computation. If the 
memory error per timestep is known and is substantially 
less than the operational error, this can be exploited to 
avoid some parallelism. 

The utility of error locations comes from the observa- 
tion that the actual behavior of a quantum network can 
be represented (non-uniquely) as a mixed sum of net- 
works with linear error operators placed at each error 
location. Each network in the sum is associated with 
a state of the environment. We call this an error ex- 
pansion of the network. The final state of the computa- 
tion can be evaluated by obtaining the states associated 
with each summand and formally adding them. It is im- 
portant to realize that the error expansion gives correct 
input-output behavior of the entire network but need not 
accurately represent the intermediate physical states of 
the qubits. 

Assumptions on error behavior are conveniently ex- 
pressed as constraints on allowed error expansions. There 
are three classes of constraints that can be considered. 
The first involves the types of error operators that can 



occur at a given location. We will for the most part 
assume that these operators do not lead to loss of ampli- 
tude from the two dimensional computational subspace 
in a qubit (leakage errors). We will briefly discuss how 
this assumption can be relaxed by exploiting special gates 
which reliably return lost amplitudes to the computa- 
tional subspace. With the assumption that there are no 
leakage errors, we can, without further loss of general- 
ity, take the error operators to be one of the standard 
errors (no error, bit flip, sign flip or both). An additional 
assumption we will use is that errors in classical compu- 
tations based on measurement outcomes are error free. 
This is a good approximation to what is possible in prac- 
tice. We will return to this assumption in the concluding 
comments. 

The second class of constraints involves the nature of 
the mixture. The analysis of our methods is simplest 
when the mixture is obtained by stochastically and in- 
dependently placing one of the standard errors at each 
error location. Given our assumption on the error op- 
erators, this is equivalent to requiring that the states of 
the environment associated with each summand of the 
error expansion are orthogonal. A weaker assumption re- 
quires only that a stochastic error expansion exists with- 
out making restrictions on the operators involved. In this 
case stochasticity is defined as having orthogonal environ- 
ments associated with each summand. For such expan- 
sions it makes sense to define the probability of error at 
a given location as the probability of those summands in 
the expansion which do not have an identity operator at 
this location. Note that these probabilities are in princi- 
ple state dependent. Since the input states are in effect 
predetermined in a quantum network, the probabilities 
are fixed but may be difficult to obtain by calculation. 

The third class of constraints enforces independence of 
errors at different locations. With this in mind we define 
the following error models: 

• Independent stochastic errors: The error expan- 
sion is obtained by making an independent, random 
choice at each error location of either the identity 
operator or a quantum operation. A quantum op- 
eration is defined as a stochastic (in the sense de- 
fined above) combination of linear operators satis- 
fying a unitarity condition [g3|,^4| . The probability 
of error at a given location is defined as the prob- 
ability of making the latter choice. The maximum 
probability of failure over all error locations is the 
error probability associated with the model. A con- 
venient strengthening of this error model requires 
that the quantum operation consists of a random 
choice of one of the standard errors. 

• Independent errors: The error expansion is ob- 
tained by assigning a quantum operation to each 
error location. In this case we can no longer talk 



of error probabilities. The error strength of a quan- 
tum operation is defined below. The error strength 
associated with this model is the maximum error 
strength of the quantum operations. 

• Quasi-independent stochastic errors: An error ex- 
pansion satisfies the quasi-independent stochastic 
error model with error probability p if it can be de- 
composed into a stochastic sum with the property 
that the probability of all summands which have a 
non-identity quantum operation at a given k many 
error locations is at most p k . 

• Quasi-independent errors: Let each summand of an 
error expansion be associated with a set of failed er- 
ror locations such that all other error locations are 
instantiated with an identity operator. Such an er- 
ror expansion satisfies the quasi-independent error 
model with error strength p if the total strength of 
the summands for which at least a given k many 
error locations have failed is at most p k . It satisfies 
the quasi-independent monotonic error model with 
bound C if the total strength of any subset of these 
summands is at most Cp k . 

The analysis to be presented below establishes thresh- 
olds for quasi-independent stochastic and monotonic er- 
rors. The analysis for quasi-independent errors without 
the monotonicity assumption is more complicated and 
yields a somewhat worse threshold. It will be presented 
elsewhere. 

The strength of a set of linear operators labeled by 
states of the environment is defined as follows: 



En a * 



sup 

\4>) 



J2 i e ')^ 



This is the maximum modulus of the amplitude of the 
outcome of applying the operation to a (normalized) 
state. Given a representation of a quantum operation 
of the form \eo)I + J2i \ e i)^-ii its error strength is the 
strength of the second term. Any quantum operation 
has a representation of this form with the property that 
trAj = for each i > 1. By default, the error strength 
is determined by such a representation In this case, the 
error strength is independent of the choice of represen- 
tation with this property. Note that in the case of sum- 
mands of error expansion, we could, at least in principle, 
replace the supremum in the definition of error strength 
by evaluation at the known input state. Error strength 
is closely related to the standard notion of fidelity [E3 24 
but easier to analyze in the present context. For stochas- 
tic models, error probability is given by the square of 
the error strength. Thus noise limits are generally much 
more stringent when considering non-stochastic models. 
The error models described above can be used to bound 



the probability^] of a network's computation failing. This 
is at most the probability of at least one error location 
having a non-identity operator in the error expansion. 
Suppose the network has n error locations. Then for the 
quasi-independent stochastic or monotone models with 
error probability p, this is at most np or Cnp, respec- 
tively. For the quasi-independent error model with error 
strength p this is given by (1 + p) n — 1 H. Thus high 
probability of success is assured if p <C \jn. 

How realistic are these error models? Since physics is 
generally described using local interactions, it seems rea- 
sonable to assume that error events on qubits are caused 
by independent environments except when they are in- 
tentionally modified by an interaction implementing a 
multi-qubit operation. This is the independent error 
model in physical terms. It covers not only independent 
stochastic errors, but also non-identity unitary operators 
at each error site. For example, a consistent modification 
of the internal energies of each qubit by a weak external 
field is allowed, provided the deviations are small enough. 
The quasi-independent error model is substantially more 
general than the independent error model. In addition to 
other error types, it can also model weak pairwise inter- 
actions between adjacent qubits. The quasi-independent 
monotonic error model makes the reasonable additional 
assumption that relevant sums of subsets of operators in 
an error expansion do not conspire to greatly increase the 
modulus of the amplitude of the input state. 

The assumption that no amplitude is lost from the 
computational systems can be quite unrealistic. For ex- 
ample in the ion trap, amplitude may be lost to any of the 
other available levels, some of which are in fact needed 
for some operations and readout. Amplitude loss can 
be modeled with error expansions by extending the di- 
mension of each system and allowing non-computational 
error operators. However, the fault tolerant networks im- 
plemented here can fail in the presence of these errors. 
To make them work requires the use of stop leak gates as 
described in the analysis section. 

Although the above arguments suggest that the quasi- 
independence assumptions can be satisfied in principle, it 
is worth pointing out that on the surface, some proposed 
implementations such as the ion trap quantum computer, 
violate this assumption from the beginning by involving a 
shared bus in every two-qubit operation. To ensure that 
independence can still be assumed requires reliable dissi- 
pation of residual information in the bus qubit between 
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any two operations using it. The need for such dissipa- 
tion is similar to the need for reliable methods to restore 
amplitude to the computational state space of a qubit 
in the case of leakage errors. Dissipation of bus qubit 
information is used in |2q] for controlling bus errors. 



C. Quantum error-correction 

The first element required for fault tolerance is quan- 
tum error-correction. In classical communication and 
computation, error-correction is usually accomplished by 
redundantly encoding information. The simplest and 
quite effective if inefficient method involves duplicating 
the information at least three times and using major- 
ity voting to recover it after errors have occurred. This 
method cannot be straightforwardly applied to quantum 
computers for three reasons. First it is not possible to 
clone arbitrary quantum states pa. Second, in order 
to take a majority vote, it is naively thought that we 
must first learn the encoded information by measure- 
ment. This would destroy any quantum coherence of 
the state. Finally, only one type of error needs to be 
considered for classical binary information, the bit flip. 
Quantum states can be modified by a continuum of pos- 
sible errors. 

Recently Shor (9) and Steane |l0|j27| ] discovered how 
these objections could be overcome. To avoid copying 
information to introduce redundancy it is possible to 
exploit highly entangled states supported by additional 
qubits. Thus a quantum state is unitarily associated with 
a linear combination of such entangled states on suffi- 
ciently many qubits to permit recovering the information 
after the loss of information in few of the qubits. These 
linear combinations define the coding subspace. To avoid 
collapse of the quantum information by measurement in 
the process of correcting errors, it is possible to make a 
partial measurement which extracts only error informa- 
tion and leaves the encoded state untouched. This can 
be arranged by choosing an encoding with the property 
that the standard errors translate the coding subspace to 
orthogonal subspaces. To deal with the fact that there 
is a continuum of possible errors, it is sufficient to rec- 
ognize that every error can be represented as a linear 
combination of the standard errors. Together with the 
observation that linear combinations of correctable er- 
rors are also correctable, this allows discretizing the er- 
ror possibilities. The general theory of error-correction is 
discussed in |E3[ . Standard errors are introduced in p0[ . 

To prove the threshold theorem we make use of the one 
qubit single error-correcting code on seven qubits based 
on the classical Hamming code IKXp] ■ One can view this 
code as a prescription for interpreting the seven qubit sys- 
tem as a pair of abstract particles, the abstract qubit and 
the syndrome space. Thus Q®Q®Q®Q®Q®Q<i§Q ~ 
A ® S, where A is the abstract two state particle and S 



is the syndrome space. The syndrome space is endowed 
with a basis |000000 s ), |000001 s ), ■ •• , mills) (64 or- 
thonormal states). The one qubit state a|0) + /3|1) is en- 
coded as \ip) = (a\0 A ) + /3|U})|000000 S ) in A ® S. The 
representation ensures that if an error operator acts on 
one of the seven supporting qubits, the state component 
of |V->) in A is unchanged and only the syndrome space is 
affected. This permits recovery of the state \ip) by mea- 
suring S and resetting its state to 1 00000s). Provided 
that this can be done sufficiently frequently and reliably, 
one can maintain the state of the abstract particle A for 
prolonged periods, even in the presence of noise acting 
independently on the seven qubits of the code. 

The representation A®S can be specified by supplying 
observables for A and S. We provide six binary observ- 
ables for S with eigenvalues ±1 depending on the value of 
the corresponding bit in the labeling of the basis. These 
observables are given by 
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An observable for A which behaves correctly relative to 
the errors we wish to protect against is not as easy to 
provide, due to its dependence on a non-linear syndrome 
decoding method. Instead we provide the following ob- 
servable which defines the correct encoding subspace, and 
for given values of the syndrome observable gives a basis 
related to the abstract particle's natural basis by one of 
the standard errors: 



Ai = a z 
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Which standard error affects this observable given the 
state of the syndrome space can be determined from the 
details of the decoding method. 

The fact that this code corrects one qubit errors is es- 
tablished in Q. Each of the syndrome's observables can 
be measured by a simple circuit which determines a par- 
ity in either the |0), |1) or the |+)|— ) basis of the qubits. 
The parity checks yield the syndrome state. Each com- 
bination of standard errors applied to the qubit changes 
the values of the syndrome observables in a determinis- 
tic fashion. Each error consisting of at most one bit flip 
and one sign flip yields a distinct syndrome state. Thus, 
which of these errors occurred can be learned from the 
syndrome, and the error can be corrected (up to a global 
phase) by applying the same operators again. 



D. Fault tolerant error-correction 

Error-correcting codes work under the assumptions 
that the encoding and recovery (the step consisting of 
detecting the errors and correcting them) are error free. 
This can be a good approximation in the case of quantum 
communication or memory where the errors occur mostly 
during transmission or idle time and not in the encoding 
and recovery period. In general, we cannot expect that 
the operations involved in recovering the encoded state 
are exact and a method must be devised for implement- 
ing them such that any single error (in the case of the 
7-qubit code) occurring anywhere in the network can be 
eliminated. An efficient method for accomplishing this 
goal is given in [|l6|,^8). It is based on two basic ideas. 
The first is to use prepared, verified "cat" states to permit 
extracting the syndrome information without directly ap- 
plying multi-qubit operations to the qubits of the code. 
The verification of the prepared states is used to reliably 
eliminate pre-existing errors which could adversely affect 
more than one qubit of the code when the syndrome is 
extracted. The second idea is to perform the syndrome 
extraction multiple times to ensure that the syndrome 
has been measured correctly. This avoids the problem of 
destroying the state by failing to restore the syndrome to 
000000s). Note that the operators involved in restoring 
the syndrome act independently on each qubit. A net- 
work for fault tolerant recovery suitable for analysis is 
shown in Figures g and ||. To explicitly check that the 
method described has the desired effect of tolerating at 
least one error in the error locations of the network re- 
quires a detailed study of how errors propagate. Error 
propagation is discussed in Section [E| 



E. Encoded operations 

Quantum error correcting and fault tolerant methods 
protect quantum information when the computer is not 
actively performing logical operations on the computa- 
tional state. A quantum computation will be required to 
perform such operations. This can of course be done 
by decoding the state, applying the desired operation 
and reencoding it. However, this temporarily removes 
the protection offered by the encoding, a serious prob- 
lem if one wishes to compute fault tolerantly. Thus it is 
necessary to act directly on the encoded state by means 
of suitably encoded operations. The trick is to do this 
without having any single operational error introducing 
multi-qubit errors in (for example) the seven qubits used 
for encoding an abstract particle. The simplest method 
for accomplishing this involves implementing operations 
transversally. Thus we label the qubits of each coded 
qubit from I to 7 and permit interactions between them 
only if they have the same label. Note that with a suit- 



able choice of labels on the even states, this rule is satis- 
fied by the recovery operator, but not by the even state 
preparation procedure. In the latter case, dangerous two 
or more qubit errors are eliminated by the verification 
step. 

What operations on states encoded using the seven 
qubit code can be performed transversally? In pq | it 
is shown that the normalizer group as well as prepara- 
tion of encoded |0) and classical measurement can be 
implemented in this fashion. Such a network for the 
controlled-not is shown in Figure H. Similar implementa- 
tions are possible for many other codes as demonstrated 
by Gottesman [f29| . 

A useful property is that encoding, decoding and recov- 
ery operators can be implemented using only generators 
of the normalizer group. Measurement is performed by 
measuring each qubit in the classical basis and decoding 
the outcome classically. Preparation involves fault tol- 
erantly measuring the observable A\ in addition to the 
syndrome and resetting all observables to by applying 
a suitable combination of standard errors. 

The normalizer group is not computationally com- 
plete. In |]16), a fault tolerant method for implement- 
ing the Toffoli gate is used to achieve completeness and 
in pfl] two conceptually simpler techniques involving two- 
qubit operations are given. Here we use a third idea 
which requires only preparation and verification of the 
|tt/8) = cos(tt/8)|0) + sin(7r/8)|l) state. Figure | shows 
networks for generating a reliable encoded |7r/8) state 
given the ability to prepare unencoded |7r/8) states. The 
trick is to realize that |7r/8) is the +1 eigenstate of the 
Hadamard transform. By performing a measurement us- 



ing Kitaev's techniques |18| via a controlled Hadamard 
transform, one can obtain either \ir/8) or |57r/8). The lat- 
ter can be converted into the former by a tt/2 rotation. 
The controlled Hadamard transform can be implemented 
transversally as shown in Figure |g. To eliminate single 
errors, the measurement is performed twice with an in- 
termediate recovery network. The state is rejected if the 
two measurements do not agree. 

State preparation and measurement are important not 
only for generating and exploiting Itt/8), but for com- 
putation in general. As shown in fl31| , without the abil- 
ity to generate bounded noise initial states at any time 
during the computation, efficient fault tolerance is un- 
achievable. Intuitively, this can be explained by viewing 
fault tolerant recovery as a method for maintaining the 
error "temperature" of the computational state by trans- 
ferring error information to the cooler states such as the 
prepared even states. Measurement is useful for access- 
ing the error information and removing its entropy and 
for input/output. 



F. Concatenation 

The final ingredient required to implement fault toler- 
ance with a threshold error rate is concatenation. The 
combination of quantum error-correction, fault tolerant 
error-correction and encoded operations can be viewed as 
a technique for exploiting qubits on which we can operate 
with an error p per operation to define abstract (encoded) 
qubits with a smaller error per operation. With the im- 
plementations described above, the effective error proba- 
bility or strength is reduced (for sufficiently small p) from 
p to cp 2 , where c is to be determined below. Concate- 
nation involves applying the same combination of tech- 
niques using the abstract qubits as the starting two state 
systems for encoding. Figure o shows the networks ob- 
tained by applying concatenation twice. We shall see that 
the effective error on the encoded state after h iterations 
of the concatenation procedure is reduced to c 2 _1 p 2 . 



II. ANALYSIS 

There is a simple method for estimating accuracy 
thresholds associated with concatenation. In many cases, 
the threshold is obtained by exploiting "single-error elim- 
ination" networks, which have the property that if an 
error occurs at an error location with no other errors 
present in some region of influence, then this error will 
not affect the computational state. A naive estimate for 
the probability of error at the next level is given by the 
number of pairs of errors that can occur within the re- 
gion of influence times the square of the probability of 
error at this level. In networks such as those used in 
this work, the number of error locations in the region of 
influence is bounded by the number of qubits required 
for the largest gates (here this is the controlled-not, with 
14 qubits), times the number of operations affecting a 
qubit before an error at a given location can be elimi- 
nated (here this is estimated as 7*6*2 + 2, where 7 is 
(close to) the average number of operations contributing 
to a qubit in the cat state generator, 6 is the number of 
syndrome bits, 2 is the average number of attempts to 
measure the syndrome, and the additional 2 is for the 
correction step and the encoded operation) . For our net- 
work we get 14 * 86 = 1204 operations, which yields a 
probability of error at the next level of less than I0 6 p 2 , 
which is less than p if p < 10 -6 . This is close to what 
will be established by the more formal arguments below. 

Our analysis consists of establishing the error behav- 
ior inductively for each level of the concatenation hierar- 
chy. To do so we exploit the properties of stabilizer codes 
and the quasi-independent error models. We first prove 
the threshold theorem for the normalizer group and the 
quasi-independent stochastic error model. We then show 
how it can be extended the monotone model and to a 
complete set of operations. 



Useful properties of stabilizer codes are: 



B. Encoded gate failures 



(i) Recovery operations and encoded normalizer oper- 
ations arc implemented using normalizer operations 
only. 

(ii) The syndrome is completely determined by the 
standard error operations applied to the qubits. 

(iii) If the errors in different error locations during fault 
tolerant recovery are instantiated by standard er- 
rors and the incoming state's syndrome is given, 
then the outgoing state's syndrome is determined. 

(iv) Standard errors applied to an encoded state whose 
syndrome is given induce a standard error on the 
encoded state. 



A. Error propagation 

Recall that an instance of the error behavior of a com- 
putation is obtained by specifying one of the standard er- 
rors at each error location. The analysis of errors at the 
next level requires determining the effect of these stan- 
dard errors on the state of the syndrome between gates. 
This is accomplished by moving errors from locations in- 
ternal to the encoded gates to locations between gates by 
error propagation. The basic technique is to conjugate 
standard errors through gates as illustrated in Figure ffl. 
A complete list of conjugation relationships for standard 
errors and normalizer operations is given in Tabic O. 

It is not possible to propagate errors through measure- 
ment operations. Note however that sign flip errors do 
not affect the measurement outcome, while bit flip errors 
flip the classical outcome. Given the syndrome before a 
recovery operation and the standard errors at error loca- 
tions in the recovery operation, the classical parities that 
are obtained by the measurements are determined and 
the effect of the recovery on the state can be computed. 
In this case all errors in the recovery network can be re- 
placed by errors before and after the recovery network. 

Given the standard errors at all error locations, the 
syndromes of the encoded states between gates can be de- 
termined by first computing them for the encoded state 
preparations and then applying the above property of the 
recovery network to each gate whenever the input syn- 
dromes have been obtained. In principle this induces an 
error behavior at the next level which can then be ana- 
lyzed without further reference to the syndromes at this 
level. Unfortunately, this simple approach does not eas- 
ily permit computing the relevant error strengths at the 
next level. To do that we use additional error propaga- 
tion steps to assure quasi-independent behavior. 



For the purposes of analysis, we refine our error models 
so that each summand of the error expansion is also asso- 
ciated with a labeling of each gate or memory operation 
which declares whether or not that operation failed. The 
labeling is assumed to satisfy that any operation whose 
associated error-location has a non-identity operator has 
failed, but the converse need not hold. The induction hy- 
pothesis requires that the error model (quasi-independent 
stochastic or monotone) applies to the summands asso- 
ciated with failures at any given k error locations. Each 
of the error models defined earlier permits a failure la- 
beling such that this holds. The goal of the analysis is 
to show that the hypothesis holds at the next level for a 
quadratically smaller error parameter. 

Recall that an encoded gate consists of a (extended, for 
preparation gates) recovery network for each input en- 
coded state and a transversally encoded operation. Our 
algorithm for determining whether an encoded gate failed 
and establishing the induced behavior with errors de- 
pends only on the failure locations at the current level, 
not on the actual standard error associated with the lo- 
cation. This implies that the analysis is correct provided 
that the failure events behave stochastically. Different 
standard errors associated with the same failure patterns 
can combine non-stochastically. In principle this permits 
a similar analysis to be used for situations where the stan- 
dard errors do not commute with the network operations. 

The first step is to determine for each recovery used in 
a state preparation or preceding a gate, whether it was 
successful. It is considered successful if after a suitable 
error propagation step, the correct syndrome has been 
obtained. Recall that each recovery network consists of 
two recovery attempts, where the second one is executed 
only if the first one has failed due to an inconsistency 
in the measured parities. Each attempt involves two ex- 
tractions of the syndrome using prepared cat states. The 
following can be established by a careful analysis of the 
recovery network. 

(i) If no failure occurs in the first recovery attempt, 
then the correct syndrome has been obtained. 

(ii) If only one failure occurs in the first attempt then 
after forward or backward propagation of the er- 
rors, either the correct syndrome has been learned 
or the extracted parities are inconsistent. 

(iii) If the extracted parities in the first attempt are 
inconsistent, then (i) or (ii) holds for the second 
pair. 

This allows us to label the recovery as having failed if at 
least one failure occurred in the network for the first at- 
tempt and at least two failures occurred in the complete 
recovery network. (The second (conditional) attempts' 



failures have no effect if they are not actually executed.) 
For the purposes of getting a tighter bound on the thresh- 
old, we use the following definitions of failure which can 
be verified to be necessary for the recovery network to 
indentify an incorrect syndrome or to not indentify a syn- 
drome at all. 

Definition: A syndrome bit extraction has failed if it 
contains a failure in a location other than the second cat 
state preparation attempt. A recovery network has failed 
if it contains at least two failures of syndrome bit extrac- 
tions satisfying: The two failures are in different halves 
of the first recovery attempt, or they are in different re- 
covery attempts. 

Errors associated with a successful recovery are now 
propagated to the previous or the following encoded gate 
as needed to have the successful recovery look like an 
error- free recovery attempt. 

Any encoded gate for which one of the associated re- 
covery networks has failed, is considered a failed gate. 
After having determined which gates failed because of 
a failed recovery, we must determine which gates failed 
because of having introduced more than one error after 
the recovery networks. These are errors which may have 
arisen during the step which restores the syndrome to 
0, or during the encoded operation, or have been prop- 
agated from a successful recovery or from a subsequent 
successful gate. 

Definition: An encoded gate has failed if one of the 
associated recoveries failed, or they succeeded and there 
are at least two failures among the syndrome bit extrac- 
tions of the second syndrome measurement of one of its 
first recovery attempts, among the operations involved 
in restoring the syndrome to 0, in the encoded operation 
itself, and in the first recovery attempt of a following 
successful gate. 

Since determining whether a gate failed may require 
knowing the following gate's status, this definition re- 
quires determining failure backwards in time so that 
when a given gate is considered, the following gate's sta- 
tus is indeed known. Simpler definitions with the prop- 
erty that failure is determined by considering errors only 
in a small neighborhood of an encoded gate are possible 
but lead to somewhat worse threshold estimates. 

There are two properties of the failure declaration that 
will be required for the analysis. The first guarantees that 
if after propagation of errors there is an induced error in 
the encoded gate, the gate is determined to have failed. 
The second ensures that the failed gates can be associated 
with disjoint pairs of error locations which, according to 
the definition, contributed to the declaration of failure. 



C. Thresholds for the normalizer group 

We begin with the analysis for the stochastic error 
model and then explain how it generalizes to the mono- 



tonic non-stochastic model. The analysis exploits the 
subadditivity property of probabilities over unions of 
events to estimate the probability that a given k gates 
at the next level are considered failed. To do so requires 
calculating the number of possible minimal sets of error 
locations that can cause a given gate to fail. In our case, 
these sets are pairs of locations. Suppose that the total 
number of such pairs for a gate is /. By assumption, the 
probability for a given such pair to have failed is bounded 
by p 2 , where p is the failure probability at the current 
level. Thus the probability that the next level gate un- 
der consideration is declared a failure is bounded by fp 2 . 
Because of the second property of the failure definition, 
the failure of k next level gates requires Ik failures at this 
level, with k disjoint pairs of these failures contributing 
to the failure of each of the k gates. Thus the probabil- 
ity of failure of these gates is bounded by (fp 2 ) k , so the 
new failure probability for the stochastic error model is 
bounded by fp 2 . 

It remains to determine the number / of minimal pairs 
which can cause a gate to fail. The actual value of / de- 
pends to some extent on the gate. We will obtain an 
upper bound, and consider memory error locations sepa- 
rately from other locations. Excluding the error locations 
in the second cat state preparation attempts, the number 
of error locations in the network for extracting a bit of the 
syndrome is (19, 10) operational and memory error loca- 
tions, respectively. In the case where memory errors are 
significant, we assume that all operations are efficiently 
pipelined and that conditionally executed recovery at- 
tempts do not cause excessive delays in other operations. 
Thus we get a total of (6 * 19 + 7, 6 * 10) = (121, 60) loca- 
tions in a single syndrome extraction network (there are 
6 syndrome bits to compute and one encoded Hadamard 
transform is used in each extraction attempt to switch 
between the |0)/|1) and the |+)/|— } basis). The num- 
ber of pairs which can lead to failure of a recovery net- 
work is therefore given by 121 2 + (2 * 121) 2 = 73205 and 
181 + (2* 181) 2 = 163805 with and without memory loca- 
tions taken into account, respectively (obtained by count- 
ing pairs of locations with one in the first and the other in 
the second syndrome extraction attempt, and those with 
the one in the first and the other in the second recovery 
attempt). For state preparation, this increases to 98000 
and 220500, respectively (because of the additional syn- 
drome bit required for each syndrome extraction). For 
two qubit operations there are two recovery networks, 
which gives 2 * 73205 and 2 * 163805 minimal failure sets. 
The number of pairs of error locations that can contribute 
toward gate failure if the recovery networks succeed can 
be computed similarly. There are up to 14 + 7 = 21 er- 
ror locations associated with the encoded operation and 
the step which resets the syndrome to 0. (The maximum 
occurs for the controlled-not, with 7 operations in the 
encoded controlled-not and up to 14 required to cancel 
errors determined by the recovery network) . By removing 



error pairs in the following recoveries which would cause 
those to fail, we get (e* 12 ^ 21 ) _ 6 * 121 2 = 190785 and 
( 6 * 18 2 1+21 ) - 6 * 181 2 = 415605 for two-qubit gates. (The 
pair has to come from the second syndrome extraction 
attempt of the gate's recovery networks, from the error- 
correction, the encoded operation or the first recovery 
attempt of a subsequent gate. Those pairs which arise 
from the subsequent recoveries and cause those to fail 
have been subtracted, as well as those which introduce 
only one error in each qubyte.). Other gates have fewer 
such error pairs. By adding the values for the two qubit 
gates, we get a bound of / < 337195 and / < 743215, 
respectively. This gives threshold error bounds of about 
3.0 10~ 6 and 1.3 10~ 6 , respectively. 

The monotonic error model requires that for some C 
and error parameter p, any summand of those error op- 
erators contributing to the failure of a given k gates has 
strength at most Cp k . Because of this assumption, the 
stochastic analysis above can be used almost verbatim 
for this model. This is based on the observation that 
all the estimates given there are based on bounding the 
probability of a set of error events by representing it as 
a union of events, each of which fits the requirements for 
satisfying a bound of the form Cp k . Thus, the strength 
of the sum of events which contributes to the failure of a 
given k next level gates is bounded by C(fp 2 ) k . It can 
be seen that the requisite monotonicity condition is also 
preserved at the next level. Consequently, the bound 
for the threshold has the same value, but for strength 
rather than probabilities. The quantity C only affects 
the overhead required to achieve a desired accuracy of 
the computation at the uppermost level. 



D. Extension to a complete set of operations 

To obtain a complete set of operations it suffices adding 
the encoded |7r/8) preparation gate where needed at the 
uppermost (computational) level. To obtain the thresh- 
old requirements for this gate we bound its error given 
the error behavior of the |7r/8) gates at the previous level. 
The |7r/8) preparation step fails if one of its two recovery 
networks fail, or if there are at least two errors introduced 
into the encoded state by propagation, potentially from 
a subsequent successful gate. Conservatively, failure not 
attributable to the two recovery networks can be reduced 
to errors in the first attempts at generating the two cat 
states for the controlled encoded Hadamard transforms, 
the implementation of the controlled Hadamard trans- 
forms (including it's two required |7r/8) states), the sec- 
ond syndrome extraction in the first attempts at recovery 
in each recovery network, or the first attempt at recovery 
in the subsequent gate. The computations are similar to 
the ones given previously. The number of pairs of errors 
in this set not leading to failure of a recovery network is 



313894 and 838831, with memory errors taken into ac- 
count. The number of pairs of errors leading to failure of 
one of the two recovery networks is 146410 and 327610, 
respectively. Adding these leads to slightly worse thresh- 
olds of 2.2 10" 6 and 0.9 10" 6 , respectively. 



E. Leakage errors 

The fault tolerant networks analyzed above are not 
guaranteed to be able to suppress leakage errors. To 
do that one can use a stop leak gate for qubits which 
(in the absence of noise) has the property that a state 
in the computational space is untouched, while any am- 
plitude outside this space is irreversibly returned to the 
computation. Such stop leak gates must be inserted be- 
fore each attempt at extracting the syndrome bits at the 
physical level, thus introducing a number of additional 
error locations that must be accounted for. Using these 
gates at the physical level changes the interpretation of 
an encoded qubit and the behavior of the encoded gates. 
The abstract particle definition of the encoded qubit is 
modified so that single leakage events do not destroy the 
encoded information. The encoded gates act correctly 
on states where at most one supporting qubit has lost 
its amplitude. If more qubits lose amplitude, that con- 
stitutes a leakage event at the next level. However, stop 
leak measures are no longer explicitly needed, since each 
gate's action has been extended so that (in the absence 
of an excess of internal errors after error propagation) it 
also returns the amplitude to the encoded computational 
space. Note that although error propagation cannot be 
handled quite as algebraically as is possible with the stan- 
dard error group, it is still possible to move leakage er- 
rors to other locations, but with the new failure opera- 
tor no longer explicitly determined. Alternatively one 
can linearly represent all possible operators using stan- 
dard errors for higher dimensional spaces. One such ap- 
proach involves artificially splitting an extension of the 
full Hilbcrt space available to a physical qubit into Q®L 
such that Q ® |0) is the computationally useful space. 
This is akin to the abstract particle representation of the 
encoded information, with L playing the role of the syn- 
drome space. The stop leak gate behaves like a 0-error 
correcting recovery operator. 



F. Overheads 

Since we have made no attempt at optimizing the over- 
heads involved with coding and concatenation we only 
provide asymptotic estimates for the method described. 
The implementation of each encoded gate requires a con- 
stant amount of resources at the previous level. Let K 
be a bound on the total number of qubits and steps at 



the previous level per encoded gate. The physical re- 
sources required for a computational gate is bounded by 
K h , where h is the number of levels in the concatena- 
tion. If the number of computational gates required is 
n, and the desired probability of failure of the compu- 
tation is q, then the number of levels is sufficient pro- 
vided that n(fp) 2 < q, where p is the physical prob- 
ability of failure. This gives h > log 2 (log 1 /(y p )(n/g)) 
and an overhead per computational operation of at least 
K h > (log 2 (n/q)/\og 2 (l/(f P ))y°^ K \ which is polylog- 
arithmic in n and 1/q. With the assumption that mea- 
sured qubits can be freely reused this is also a bound on 
the number of qubits required to support each compu- 
tational qubit. Otherwise, this overhead can increase by 
an additional factor related to the the number of gates 
the qubit is involved in. In our case log 2 (K) is about 
10, which can be quite daunting in practice. Substan- 
tial asymptotic improvements can be obtained by using 
different codes at higher levels and by encoding multiple 
qubits using single blocks. 



III. CONCLUSION 

We have demonstrated that quantum computation 
with classical input can be performed arbitrarily accu- 
rately provided that the noise per operation is sufficiently 
small and satisfies suitable independence assumptions. 
The implementation of fault tolerant quantum computa- 
tion is straightforward. Since the overheads are asymp- 
totically well behaved, the threshold results demonstrate 
that quantum computation is possible in the presence of 
physically reasonable sources of noise. 

Threshold results have been obtained independently 
by Kitaev pl| and Aharonov and Ben-Or p2f. Both 
Kitaev and Aharonov and Ben-Or analyze independent 
stochastic error models and obtain completeness of oper- 
ations by adopting Shor's implementation of the Toffoli 
gate. Kitaev uses a different method for fault tolerantly 
extracting the syndrome. His method is less efficient 
and consequently yields substantially worse thresholds. 
Aharonov and Ben-Or provide an analysis which does 
not require accurate classical computation for syndrome 
calculations and estimate a threshold of around 10~ 6 for 
the independent stochastic error model. There may be 
some cases where this extension is needed, for example 
when performing stochastically parallel quantum com- 
putations such as those envisioned for NMR quantum 
computation p3| , p4| . Our techniques for generalizing ar- 
guments from stochastic error models to coherent error 
models can in principle be used to extend their analysis. 

Not only do the threshold theorems show that quan- 
tum computation is possible in principle, but they 
demonstrate that the apparent distance limitations of 
quantum cryptography can be overcome. It suffices to 



be able to transmit the state of qubits over some rea- 
sonable distance before recovery operations must be ap- 
plied to avoid loss of encoded information. This does of 
course require compatible physical realizations of qubits 
for transmission over channels and for manipulation in a 
quantum computer. 

The actual values of the thresholds we have obtained 
are rigorous, but overly pessimistic in several ways. First, 
the error models used are the most adversarial still sat- 
isfying independence assumptions. We assume that the 
error behavior at each location is the worst possible for 
the network subject only to bounds on the strength of 
correlations. In practice, we need not worry about such 
adversarial error behavior and the actual error types at 
the physical level are likely to be much more constrained 
than assumed by our error-blind analysis. That known 
error behavior can be exploited to reduce error has been 
demonstrated in a specific example by Pellizzari, Cirac, 
Pcllizzari and Zoller |25|] . In addition, simulations due to 
Preskill's team (private communication) and Zalka |3Jj] 
suggest that for the depolarizing channel, thresholds are 
substantially better than suggested by our calculations. 
Second, we have made no attempt to optimize the imple- 
mentation of fault tolerance. Suggestions for optimiza- 

Finally, it is clear that our 



tion can be found in 30 3E 
failure definitions are excessively conservative, and a sub- 
stantial fraction of error pairs which lead us to consider 
a gate failed in fact do not induce an error at the next 
level. Nevertheless, the results suggest that over-rotation 
and other errors not representable stochastically must be 
controlled more carefully than stochastic noise. 

Whether fault tolerant quantum computation can be 
implemented in practice remains to be seen. However, 
the results obtained here show that in principle noise of 
a level below the error threshold is not an obstacle for 
quantum computation. 
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Hadamard rotation 
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controlled- not, xor 
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Toffoli gate 
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\ x )\y)\ z ) -* \x)\y)\z + xy mod 2) 



Preparation of \ip) 



Measurement of a qubit 



TABLE I. Elementary unitary operations on one to three qubits. 

SN = -NS 
SH = HN 
NH = HS 

NSt = -iS t N 

(I®S)N 2 = N 2 (S®S) 

(S®I)N 2 = -N 2 (S®I) 
(I®N)N 2 =N 2 (I®N) 
(N®I)N 2 = N 2 (N®N) 

TABLE II. Error propagation identities obtained by conjugation (EV = V(V' EV)). 
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FIG. 1. Construction of a Toffoli gate from the primitves given in Table 1. The first figure gives a controlled-controlled-NS. 
The second gate is a Tofoli gate for the first 3 qubit, whatever the 4th bit is. 
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FIG. 2. Fault tolerant calculation of the syndrome for the 7 bit code. The even state is obtained from the fault tolerant 
operation given by [shor] 
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FIG. 3. Verification of the syndrome of a qubyte. The syndrome for both bit flips Sb and sign flips Ss are calculated twice 
to learn if the error occured during the syndrome oepration. 
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FIG. 4. Fault tolerant implementation of a control not between two qubytes. Each qubit of a qubyte interacts at most with 
one qubit of another qubyte: this is the transversality property. 
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FIG. 5. Fault tolerant network giving purified |7r/8) states. 
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Concatenated Code 
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FIG. 6. Concatenation of the 7 bit code. If the error rate is e for the qubits, the encoding will gives a rate of C 2 1 e 2 for 



the h level of the hierarchy. 




FIG. 7. The top part of the figure shows the error location for a controlled-not gate. The second part shows the propagation 
of a sign flip in the target bit. This type of error propagates from the target to the control bit. 
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